3-13: Figure Internet Protocol (IP)
IP Addresses and Security
IP address spoofing: Sending a message with a false IP address (Figure 3-17) Gives sender anonymity so that attacker cannot be identified Can exploit trust between hosts if spoofed IP address is that of a host the victim host trusts
1
Figure 3-17: IP Address Spoofing
1. Trust Relationship 3. Server Accepts Attack Packet Trusted Server 60.168.4.6 Victim Server 60.168.47.47
2. Attack Packet Spoofed Source IP Address 60.168.4.6 Attackers Client PC Attackers Identity is 1.34.150.37 Not Revealed
2
Figure 3-13: Internet Protocol (IP) (Study Figure)
IP Addresses and Security
LAND attack: send victim a packet with victims IP address in both source and destination address fields and the same port number for the source and destination (Figure 3-18). In 1997, many computers, switches, routers, and even printers, crashed when they received such a packet.
3
Figure 3-18: LAND Attack Based on IP Address Spoofing
Attacker 1.34.150.37
From: 60.168.47.47:23 To: 60.168.47.47:23
Victim 60.168.47.47 Port 23 Open Crashes
Source and Destination IP Addresses are the Same Source and Destination Port Numbers are the Same
4
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Protocol field: Identifies content of IP data field
Firewalls need this information to know how to process the packet Each router decrements the TTL value by one Router decrementing TTL field to zero discards the packet 5
Time-to-Live field
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Time-to-Live field
Router also sends an error advisement message to the sender The packet containing this message reveals the senders IP address to the attacker Traceroute uses TTL to map the route to a host (Figure 3-19) Tracert on Windows machines 6
Figure 3-19: Tracert Program in Windows
7
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Header Length field and Options With no options, Header Length is 5 Expressed in units of 32 bits So, 20 bytes Many options are dangerous if So Header Length is More Than 5, be Suspicious Some firms drop all packets with options 8
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Length Field
Gives length of entire packet Maximum is 65,536 bytes Ping-of-Death attack sent IP packets with longer data fields Many systems crashed
9
Figure 3-20: Ping-of-Death Attack
Attacker 1.34.150.37
IP Packet Containing ICMP Echo Message That is Illegally Long
Victim 60.168.47.47 Crashes
10
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Fragmentation Routers may fragment IP packets (really, packet data fields) en route All fragments have same Identification field value Fragment offset values allows fragments to be ordered More fragments is 0 in the last fragment
Harms packet inspection: TCP header, etc. only in first packet in series
Cannot filter on TCP header, etc. in subsequent packets
11
Figure 3-22: TCP Header is Only in the First Fragment of a Fragmented IP Packet
1. Fragmented IP Packet 2. Second Fragment 4. TCP Data IP Field Header No TCP Header 2. First Fragment TCP Data Field IP Header 5. Firewall 60.168.47.47 Can Only Filter TCP Header in First Fragment
Attacker 1.34.150.37
3. TCP Header Only in First Fragment
12
Figure 3-13: Internet Protocol (IP) (Study Figure)
Other IP Header Fields
Fragmentation
Teardrop attack: Crafted fragmented packet does not make sense when reassembled Some firewalls drop all fragmented packets, which are rare today
13
Figure 3-21: Teardrop Denial-ofService Attack
Defragmented IP Packet Gap Overlap
Attacker 1.34.150.37 Attack Pretends to be Fragmented IP Packet When Reassembled, Packet does not Make Sense. Gaps and Overlaps
Victim 60.168.47.47 Crashes
14
Figure 3-24: IP Packet with a TCP Segment Data Field
Bit 0 IP Header (Usually 20 Bytes) Source Port Number (16 bits) Destination Port Number (16 bits) Bit 31
Sequence Number (32 bits) Acknowledgment Number (32 bits) Header Length (4 bits) Reserved (6 bits) Flag Fields (6 bits) Window Size (16 bits) Urgent Pointer (16 bits)
TCP Checksum (16 bits)
15